MITRE ATT&CKsoftware (malware)

S1228 PUBLOAD

Published 2025-08-04 Modified 2026-05-12 Official page ↗
Domain
enterprise
Platforms
Windows
Version
1.1
Created
2025-08-04

Description

PUBLOAD is a stager malware that has been observed installing itself in existing directories such as `C:\Users\Public` or creating new directories to stage the malware and its components. PUBLOAD malware collects details of the victim host, establishes persistence, encrypts victim details using RC4 and communicates victim details back to C2. PUBLOAD malware has previously been leveraged by China-affiliated actors identified as Mustang Panda. PUBLOAD is also known as “NoFive” and some public reporting identifies the loader component as CLAIMLOADER.

Related

Uses · MITRE ATT&CK (35)

  • T1680 Local Storage Discovery technique
  • T1027.015 Compression sub-technique
  • T1016.002 Wi-Fi Discovery sub-technique
  • T1622 Debugger Evasion technique
  • T1614.001 System Language Discovery sub-technique
  • T1016.001 Internet Connection Discovery sub-technique
  • T1480.001 Environmental Keying sub-technique
  • T1573.001 Symmetric Cryptography sub-technique
  • T1001.003 Protocol or Service Impersonation sub-technique
  • T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol sub-technique
  • T1071.001 Web Protocols sub-technique
  • T1071.002 File Transfer Protocols sub-technique
  • T1574.001 DLL sub-technique
  • T1059.003 Windows Command Shell sub-technique
  • T1518.001 Security Software Discovery sub-technique
  • T1560.001 Archive via Utility sub-technique
  • T1036.005 Match Legitimate Resource Name or Location sub-technique
  • T1553.002 Code Signing sub-technique
  • T1547.001 Registry Run Keys / Startup Folder sub-technique
  • T1053.005 Scheduled Task sub-technique
  • T1518 Software Discovery technique
  • T1205 Traffic Signaling technique
  • T1140 Deobfuscate/Decode Files or Information technique
  • T1007 System Service Discovery technique
  • T1012 Query Registry technique
  • T1016 System Network Configuration Discovery technique
  • T1027 Obfuscated Files or Information technique
  • T1033 System Owner/User Discovery technique
  • T1047 Windows Management Instrumentation technique
  • T1049 System Network Connections Discovery technique
Show all 35 ›

Referenced by MITRE ATT&CK · uses (1)

  • G0129 Mustang Panda group

References